Skip to content

Commit f4b2437

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Thu Sep 10 08:28:50 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent 95e2986 commit f4b2437

10 files changed

Lines changed: 186 additions & 29 deletions

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 129 additions & 21 deletions
Large diffs are not rendered by default.

‎data/fix-commits/camel-36fc325a.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"vcs_url": "https://github.com/apache/camel",
33
"vulnerabilities": {
4+
"CVE-2026-45799": {
5+
"76a4eef4a6ba912df31bfc1ee3a7936336b419b6": "Pin com.squareup.wire:wire-runtime to 6.4.7 to remediate CVE-2026-45799 (#26243)\n\namazon-kinesis-client pulls software.amazon.glue:schema-registry-serde, which\npins Square Wire at 5.2.0. skipGroup() before Wire 6.3.0 does not reject a\nnegative LENGTH_DELIMITED length, so a crafted payload makes\nProtoAdapter.decode(byte[]) throw an unchecked ArrayIndexOutOfBoundsException\ninstead of the documented IOException. schema-registry-serde 1.1.27 is the\nlatest release and is still on Wire 5.2.0, so the version is managed here.\n\nOnly wire-runtime is bumped. wire-schema, wire-compiler and the Wire code\ngenerators stay at 5.2.0 because the Glue serde binds to\ncom.squareup.wire.schema.internal.parser.ProtoFileElement, whose constructor\ngained a parameter in Wire 5.3.0 - aligning every Wire artifact breaks\nFileDescriptorUtils with a NoSuchMethodError. No Wire release has both the\n9-arg constructor and the CVE fix, so splitting the versions is the only\ncombination that satisfies both.\n\nwire-runtime is an empty Kotlin-Multiplatform metadata artifact; wire-runtime-jvm\ncarries all the classes and is the entry that applies the fix. Both are pinned\nbecause the advisory lists both coordinates.\n\nCamel itself never reaches the vulnerable code: the Glue serde uses Wire only as\na .proto schema-text parser, and the KCL consumer never enables the Glue schema\nregistry. This removes a recurring false positive for downstream consumers.\n\nCo-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>"
6+
},
47
"CVE-2025-27636": {
58
"6fbaa6bb67ccd2cc78afb983a570d34387dda870": "CAMEL-24655: camel-coap - guard case-insensitive header filtering, backport to camel-4.18.x (#26217)\n\nCAMEL-24655: camel-coap - guard case-insensitive header filtering\n\nThe CoAP consumer maps the URI query parameters of an incoming request\ninto Exchange headers, running each through the endpoint\nHeaderFilterStrategy first. The default strategy filters names starting\nwith Camel/camel case-insensitively, so a remote peer cannot set Camel\ninternal headers that steer downstream processing. That behaviour was\ncorrect but untested, so a refactoring of the consumer could silently\ndrop it - the exact regression the CVE-2025-27636 family was about.\n\nAdds CoAPHeaderInjectionTest: sends requests carrying a Camel internal\nheader name as a URI query parameter in four casings and asserts it is\nnever mapped onto the Exchange, while an ordinary query parameter still\nis. Verified to fail when the filter call in CamelCoapResource is\nremoved. Test-only; no production code is modified.\n\nBackport of #26208 to camel-4.18.x.\n\nOne adaptation was needed: CoAPTestSupport.PORT is a plain int on this\nbranch, not an AvailablePortFinder.Port, so the route uses PORT rather\nthan PORT.getPort(). Nothing else differs from the original.\n\n\n(cherry picked from commit e6e5621639a1e39540feb57d5f1b3687069ce565)\n\nSigned-off-by: Claus Ibsen <claus.ibsen@gmail.com>\nCo-authored-by: Andrea Cosentino <ancosen@gmail.com>\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",
69
"406802a19162ae11458b154ea2443084e66e8616": "CAMEL-24655: camel-coap - guard case-insensitive header filtering, backport to camel-4.22.x (#26216)\n\nCAMEL-24655: camel-coap - guard case-insensitive header filtering\n\nThe CoAP consumer maps the URI query parameters of an incoming request\ninto Exchange headers, running each through the endpoint\nHeaderFilterStrategy first. The default strategy filters names starting\nwith Camel/camel case-insensitively, so a remote peer cannot set Camel\ninternal headers that steer downstream processing. That behaviour was\ncorrect but untested, so a refactoring of the consumer could silently\ndrop it - the exact regression the CVE-2025-27636 family was about.\n\nAdds CoAPHeaderInjectionTest: sends requests carrying a Camel internal\nheader name as a URI query parameter in four casings and asserts it is\nnever mapped onto the Exchange, while an ordinary query parameter still\nis. Verified to fail when the filter call in CamelCoapResource is\nremoved. Test-only; no production code is modified.\n\nBackport of #26208 to camel-4.22.x.\n\n\n(cherry picked from commit e6e5621639a1e39540feb57d5f1b3687069ce565)\n\nSigned-off-by: Claus Ibsen <claus.ibsen@gmail.com>\nCo-authored-by: Andrea Cosentino <ancosen@gmail.com>\nCo-authored-by: Claude Opus 5 <noreply@anthropic.com>",

‎data/fix-commits/gentoo.git-f7ec53e2.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,21 @@
11
{
22
"vcs_url": "https://gitweb.gentoo.org/repo/gentoo.git",
33
"vulnerabilities": {
4+
"CVE-2026-10805": {
5+
"eafe7bdca65bcb3eedb33770110077576719647b": "net-misc/networkmanager: add 1.58.1\n\n* upstream changes contain fix for CVE-2026-10805. Necessary ebuild changes\n only, other changes postponed to a follow-up PR:\n * add slang dep for nmtui\n * Remove obsolete dhclient use flag,\n * Remove obsolete 'modify_system' meson option which \"is no longer allowed due\n to security reasons\"\n\nSee: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/0b75d905e59999539ab1e92a92646b634c221215\nSee: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/1756ec54e384cc7e66878e9eecf7dd713df9de29\nSee: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/fbcaa53b42a8483e00ab3c17919eb7e6504beb1a\nBug: https://bugs.gentoo.org/981154\nBug: https://bugs.gentoo.org/981249\nSigned-off-by: Lukas Schmelting <lschmelting@posteo.com>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1717\nMerges: https://codeberg.org/gentoo/gentoo/pulls/1717\nSigned-off-by: Sam James <sam@gentoo.org>"
6+
},
7+
"CVE-2026-61627": {
8+
"6b3fe0196dbac1febcd8a1bd8de4f7e08e0ab289": "media-libs/libass: add 0.17.5\n\nThis includes two security fixes for\n - CVE-2026-61627 / GHSA-pjjp-65r7-ppgm\n - CVE-2026-61626 / GHSA-5gf7-wjfm-vmvm\n\nBug: https://bugs.gentoo.org/982219\nSigned-off-by: Oneric <oneric@oneric.stub>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1814\nSigned-off-by: Sam James <sam@gentoo.org>"
9+
},
10+
"CVE-2026-61626": {
11+
"6b3fe0196dbac1febcd8a1bd8de4f7e08e0ab289": "media-libs/libass: add 0.17.5\n\nThis includes two security fixes for\n - CVE-2026-61627 / GHSA-pjjp-65r7-ppgm\n - CVE-2026-61626 / GHSA-5gf7-wjfm-vmvm\n\nBug: https://bugs.gentoo.org/982219\nSigned-off-by: Oneric <oneric@oneric.stub>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1814\nSigned-off-by: Sam James <sam@gentoo.org>"
12+
},
13+
"GHSA-PJJP-65R7-PPGM": {
14+
"6b3fe0196dbac1febcd8a1bd8de4f7e08e0ab289": "media-libs/libass: add 0.17.5\n\nThis includes two security fixes for\n - CVE-2026-61627 / GHSA-pjjp-65r7-ppgm\n - CVE-2026-61626 / GHSA-5gf7-wjfm-vmvm\n\nBug: https://bugs.gentoo.org/982219\nSigned-off-by: Oneric <oneric@oneric.stub>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1814\nSigned-off-by: Sam James <sam@gentoo.org>"
15+
},
16+
"GHSA-5GF7-WJFM-VMVM": {
17+
"6b3fe0196dbac1febcd8a1bd8de4f7e08e0ab289": "media-libs/libass: add 0.17.5\n\nThis includes two security fixes for\n - CVE-2026-61627 / GHSA-pjjp-65r7-ppgm\n - CVE-2026-61626 / GHSA-5gf7-wjfm-vmvm\n\nBug: https://bugs.gentoo.org/982219\nSigned-off-by: Oneric <oneric@oneric.stub>\nPart-of: https://codeberg.org/gentoo/gentoo/pulls/1814\nSigned-off-by: Sam James <sam@gentoo.org>"
18+
},
419
"CVE-2025-14847": {
520
"247d4663ce20aeec22082f209945c5bd3cb21db4": "dev-db/mongodb: Make requested changes to ebuilds\n\n.. and patches.\n\n* Remove 8.0.8 and 8.0.12 as they are vulnerable to mongobleed(CVE-2025-14847).\n* Remove 8.2.9, superceded by 8.3.x.\n* Version bump 8.0.23 to 8.0.26.\n\nBug: https://bugs.gentoo.org/968160\nBug: https://bugs.gentoo.org/967856\nBug: https://bugs.gentoo.org/976310\nSigned-off-by: Aaron Sears-Aldridge <geodelic@gmail.com>\nPart-of: https://github.com/gentoo/gentoo/pull/46392\nSigned-off-by: Sam James <sam@gentoo.org>"
621
},

0 commit comments

Comments
 (0)